791–800 of 1001 posts
Amazingly, this was disclosed offhand on the Apple developer forums, two weeks ago (see final comment by chethan177): https://forums.developer.apple.com/thread/79235 (spotted by https://twitter.com/fristle/status/935670476214378496 )
This is comical at this point. I have no idea how such vulnerable software makes it to production. It is really ironic that a company, making billions of dollars and branding itself as the leaders of quality, stability and so on, to have this kind of vulnerability. I have truly lost faith in Apple.
Agreed. iOS 11 was the tipping point for me (can't delete photos using trash icon, wrong orientation when unlocking phone, random lag/freezes etc). Apple just doesn't care any more.
(Sorry, couldn't resist writing :) )
Amazingly, this was disclosed offhand on the Apple developer forums, two weeks ago (see final comment by chethan177): https://forums.developer.apple.com/thread/79235 (spotted by https://twitter.com/fristle/status/935670476214378496 )
That’s absolutely terrible. Does Apple not monitor those forums at all?
I could see how someone would dismiss a posting like that with an "this cannot possibly be true" shrug.
Earlier quoted context omitted.
Possibly not, but the death & maiming stats everywhere show we're absolutely not ready for human-driven ones.
Thank you I imagine a Twilight Zone episode... Go back in time to before cars were invented and imagine some Mephistopheles offering the bargain: "You'll fly like the wind over hills and mountains, making a journey of days in mere hours!" What the catch? "For each mile traveled a certain number of people chosen at random must be put to death or maimed." He would go on about how the chances of someone you love being c…
As for human readiness to safely control a tonne of speeding metal, my position as a full-time motorcyclist makes me extremely confident that the average alleged 'driver' (actually: daydreamer, snot-picker, instagrammer) isn't even approaching the edge of the competence ballpark.
Anyone else think it was a bad idea to disclose this so publicly over Twitter? I thought that the usual practice was to let the development team know first.
Time and time again we have been shown that the way to a company's heart is through it's PR department. This is a dev complaining to Apple like a lunchgoer would complain to Mc D's about a bad burger. Expect more of it.
I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?
Maybe something like this was added to make debugging/testing of the OS easier? maybe they just forgot to remove it before shipping the new macOS
Be careful testing this! It appears that you're creating a "root" superuser with no password. Be sure to clean up that user afterwords. https://twitter.com/a_hailes/status/935601901839806464
You're not creating it, but rather enabling it. When the bug is triggered, the root user is enabled (per Directory Utility).
Can this be used remotely? Edit: Yes, after turning on Remote Management on my second mac I was able to log into it using Remote Desktop, account root and no pw. It only works after getting physical access once.
You can get undetectble remote access on most machines given "physical access once", so I don't think this qualifies as "remotely exploitable".
https://www.youtube.com/watch?v=FpOH0lxEGBE
They seem to be remotely accessing the machine to both set and then use the root account.
Earlier quoted context omitted.
`sudo dscl . -read Users/root accountPolicyData`
When you do this you'll get the creationTime and passwordLastSetTime as seconds since the 'epoch' – January 1, 1970, 00:00:00 (UTC). These are numbers like 1474441704.265237 which aren't very easy for a human to read :-) To convert this into a human-readable date and time, open a terminal and do this: python >>> import time >>> time.strftime("%a, %d %b %Y %H:%M:%S", time.localtime(1474441704.265237)) You'll get somet…
date -r 1474441704Earlier quoted context omitted.
When you do this you'll get the creationTime and passwordLastSetTime as seconds since the 'epoch' – January 1, 1970, 00:00:00 (UTC). These are numbers like 1474441704.265237 which aren't very easy for a human to read :-) To convert this into a human-readable date and time, open a terminal and do this: python >>> import time >>> time.strftime("%a, %d %b %Y %H:%M:%S", time.localtime(1474441704.265237)) You'll get somet…
If you're already in the terminal you could instead enter date -r 1474441704